Upstream Changes:

-   weave 2.4.1 (https://github.com/weaveworks/weave/releases/tag/v2.4.1)

Our Changes:

-   Templates sync with upstream manifests

Monitor CoreDNS over svc

Fix #2261 by supporting Red Hat's limited PATH

Add volume and volumeMount for crio-socket

Fix download file

Document podsecuritypolicy_enabled and kubernetes_audit

Upgrade kubedns to 1.14.11

[bugfix] fix path to metallb configuration

absolute path for kubectl.

Fixes for upgrade mode

Put back legacy support for calico ippools and bgp settings

Uses correct flag for draining with a pod selector
Verifies minimum kubectl version for compatibility

Replace the raw rsync command with the synchronize module

This commit fixes #3295

[bugfix] Use bin_dir to find kubectl in contrib/metallb

Install Helm client on all masters

Remove --insecure-bind-address when insecure-port=0

Extra options for upgrade mode

Optionally do not drain nodes by setting drain_nodes to false
Optionally set a labelselector to target which pods should be drained.

Ensure etcd file permissions are correct when using vault

Fix wrong sa name in crb when psp is enabled

Change update strategy to RollingUpdate

Merge pull request #3288 from kubernetes-incubator/revert-3252-remove_insecure-bind-address_when_insecure-bind-port_is_0

Revert "Remove insecure-port and insecure-bind-address when possible"

When enable_network_policy is set to True with Calico 3 kubectl
apply fails with the error:

The Deployment "calico-kube-controllers" is invalid:
spec.strategy.rollingUpdate: Forbidden: may not be specified when
strategy type is 'Recreate'

See

https://github.com/kubernetes-incubator/kubespray/issues/3267

Changing the update strategy to RollingUpdate avoids this error.